Validity fingerprint sensor linux tools

Install Validity fingerprint Sensors Linux tools
on Arch Linux

Validity fingerprint Sensors Linux tools

• Marco Trevisan (Treviño) (3v1n0) Publisher
• Development
• Utilities

A Linux tool to flash and pair Validity fingerprint sensors 009x

A simple tool that helps initializing Validity fingerprint readers under linux, loading their binary firmware and initializing them.

This tool currently only supports these sensors:

• 138a:0090 Validity Sensors, Inc. VFS7500 Touch Fingerprint Sensor
• 138a:0097 Validity Sensors, Inc.

Which are present in various ThinkPad and HP laptops.

These devices communicate with the laptop via an encrypted protocol and they need to be paired with the host computer in order to work and compute the TLS keys. Such initialization is normally done by the Windows driver, however thanks to the amazing efforts of Viktor Dragomiretskyy (uunicorn), and previously of Nikita Mikhailov, we have reverse-engineerd the pairing process, and so it’s possible to do it under Linux with only native tools as well.

The procedure is quite simple:

• Device is factory-reset and its flash repartitioned
• A TLS key is negotiated, generated via host hw ID and serial
• Windows driver is downloaded from Lenovo to extract the device firmware
• The device firmware is uploaded to the device
• The device is calibrated

Here’s some output example:

You can test whether the pairing has been successfully by launching the command sudo validity-sensors-tools.led-test

For 138a:0097 it’s also possible to enroll fingers in the internal storage doing:

Once the chip is paired with the computer via this tool, it’s possible to use it in libfprint using the driver at

Источник

Install Validity fingerprint Sensors Linux tools
on Linux Mint

Validity fingerprint Sensors Linux tools

• Marco Trevisan (Treviño) (3v1n0) Publisher
• Development
• Utilities

A Linux tool to flash and pair Validity fingerprint sensors 009x

A simple tool that helps initializing Validity fingerprint readers under linux, loading their binary firmware and initializing them.

This tool currently only supports these sensors:

• 138a:0090 Validity Sensors, Inc. VFS7500 Touch Fingerprint Sensor
• 138a:0097 Validity Sensors, Inc.

Which are present in various ThinkPad and HP laptops.

These devices communicate with the laptop via an encrypted protocol and they need to be paired with the host computer in order to work and compute the TLS keys. Such initialization is normally done by the Windows driver, however thanks to the amazing efforts of Viktor Dragomiretskyy (uunicorn), and previously of Nikita Mikhailov, we have reverse-engineerd the pairing process, and so it’s possible to do it under Linux with only native tools as well.

The procedure is quite simple:

• Device is factory-reset and its flash repartitioned
• A TLS key is negotiated, generated via host hw ID and serial
• Windows driver is downloaded from Lenovo to extract the device firmware
• The device firmware is uploaded to the device
• The device is calibrated

Here’s some output example:

You can test whether the pairing has been successfully by launching the command sudo validity-sensors-tools.led-test

For 138a:0097 it’s also possible to enroll fingers in the internal storage doing:

Once the chip is paired with the computer via this tool, it’s possible to use it in libfprint using the driver at

Источник

Install Validity fingerprint Sensors Linux tools
on Fedora

Validity fingerprint Sensors Linux tools

• Marco Trevisan (Treviño) (3v1n0) Publisher
• Development
• Utilities

A Linux tool to flash and pair Validity fingerprint sensors 009x

A simple tool that helps initializing Validity fingerprint readers under linux, loading their binary firmware and initializing them.

This tool currently only supports these sensors:

• 138a:0090 Validity Sensors, Inc. VFS7500 Touch Fingerprint Sensor
• 138a:0097 Validity Sensors, Inc.

Which are present in various ThinkPad and HP laptops.

These devices communicate with the laptop via an encrypted protocol and they need to be paired with the host computer in order to work and compute the TLS keys. Such initialization is normally done by the Windows driver, however thanks to the amazing efforts of Viktor Dragomiretskyy (uunicorn), and previously of Nikita Mikhailov, we have reverse-engineerd the pairing process, and so it’s possible to do it under Linux with only native tools as well.

The procedure is quite simple:

• Device is factory-reset and its flash repartitioned
• A TLS key is negotiated, generated via host hw ID and serial
• Windows driver is downloaded from Lenovo to extract the device firmware
• The device firmware is uploaded to the device
• The device is calibrated

Here’s some output example:

You can test whether the pairing has been successfully by launching the command sudo validity-sensors-tools.led-test

For 138a:0097 it’s also possible to enroll fingers in the internal storage doing:

Once the chip is paired with the computer via this tool, it’s possible to use it in libfprint using the driver at

Источник

Install Validity fingerprint Sensors Linux tools
on Ubuntu

Validity fingerprint Sensors Linux tools

• Marco Trevisan (Treviño) (3v1n0) Publisher
• Development
• Utilities

A Linux tool to flash and pair Validity fingerprint sensors 009x

A simple tool that helps initializing Validity fingerprint readers under linux, loading their binary firmware and initializing them.

This tool currently only supports these sensors:

• 138a:0090 Validity Sensors, Inc. VFS7500 Touch Fingerprint Sensor
• 138a:0097 Validity Sensors, Inc.

Which are present in various ThinkPad and HP laptops.

These devices communicate with the laptop via an encrypted protocol and they need to be paired with the host computer in order to work and compute the TLS keys. Such initialization is normally done by the Windows driver, however thanks to the amazing efforts of Viktor Dragomiretskyy (uunicorn), and previously of Nikita Mikhailov, we have reverse-engineerd the pairing process, and so it’s possible to do it under Linux with only native tools as well.

The procedure is quite simple:

• Device is factory-reset and its flash repartitioned
• A TLS key is negotiated, generated via host hw ID and serial
• Windows driver is downloaded from Lenovo to extract the device firmware
• The device firmware is uploaded to the device
• The device is calibrated

Here’s some output example:

You can test whether the pairing has been successfully by launching the command sudo validity-sensors-tools.led-test

For 138a:0097 it’s also possible to enroll fingers in the internal storage doing:

Once the chip is paired with the computer via this tool, it’s possible to use it in libfprint using the driver at

Источник

Validity fingerprint sensor linux tools

Validity Sensor 138a:0090 and 138a:0097 libfprint driver

A linux driver for 2016 ThinkPad’s fingerprint readers

Thanks to the amazing work that nmikhailov did in his prototype and uunicorn in python-validity and synaWudfBioUsb-sandbox, I spent some time in getting a libfprint driver for the 138a:0090 (and 138a:0097 ) device up.

• It only works if the device has been initialized using validity-sensors-tools/
  • Alernatively, but it’s less secure, you can use a Windows installation with VirtualBox (sharing USB) guest or with a Windows installation in bare metal
• This version works only with fprintd2, if you still use fprintd see the old version.
• Most of the device interaction and crypto code is coming from the prototype, so basically it needs lots of cleanup, but I hope to rebase this on the code from python-validity
• Here enroll, verification, led and all the operations work
• It uses libfprint image comparison algorithm, we might move to in-device check later.

You can test it using the examples or just using fprintd-* tools (GNOME supports it natively from control center).

Device initialization and pairing

I recommend using the validity-sensors-tools/, you can install it in any distro as snap, or you can use it manually from sources located in my python validity fork

This is the only supported way by 138a:0097 , so once you’ve enrolled your fingers with validity-sensors-tools.enroll you will be able to re-enroll your fingers in fprintd to use them in linux as well.

This unfortunately can’t be done in 138a:0090 , but you can still use a Windows installation (even in VirtualBox) to enroll the prints to save them in the chip and enable the match-on-sensor, this can make the verification faster, safer and higher quality.
Unfortunately there’s currently no easy way to implement this in this driver without reverse-engineer the fingerprint template creation that the windows drivers does in host.

If you’re using ubuntu just use this PPA to get the libfprint TOD packages with vfs0090 sensor support.

Also, in the ubuntu (and derivates) the code that you will use will be based on the tod submodule.

You can enroll your fingers by using the fprintd-enroll utility or from UI using unity-control-center user-accounts in unity or gnome-control-center user-accounts in GNOME (it’s the same as going in System settings -> User accounts pane and enable the fingerprint login).

So, in steps (for ubuntu) it would be:

Then go in system settings (account) and enable the fingerprint login

Arch linux Installation

• fprintd
• libfprint-vfs0090-git from AUR

Fedora (tested on 28)

• sudo dnf install -y libusb*-devel libtool nss nss-devel gtk3-devel glib2-devel openssl openssl-devel libXv-devel gcc-c++
• git clone https://github.com/3v1n0/libfprint
• meson libfprint libfprint/_build && sudo ninja -C libfprint/_build install

NixOS has the tod module in nixpkgs-unstable (merged June 2021). On release 21.05 or newer, and assuming pkgsUnstable is an unstable nixpkgs, configure like this:

• git clone https://github.com/3v1n0/libfprint
• meson libfprint libfprint/_build && sudo ninja -C libfprint/_build install

Help testing (only for 138a:0090 )

It would be nice if you could help in tuning the value of the bz3_threshold , as that’s the value that defines how different should be the prints, and so it’s important for having better security. I’ve set it to 12 currently, but of course increasing the number of prints we enroll or the image quality that could be increased.

Using fprint_demo or monitor fprintd from journalctl you should be able to see the values such as fpi_img_detect_minutiae and fpi_img_compare_print_data in the log, like

The score is the value the print got for you, compared to each sample that fprint saves. And to match it needs to reach the said threshold (so 12 for now). For my fingers this value seems secure enough, but. Let’s see if we can increase it.

Источник